Google Apps “googleapopos.url.mailto” Uri Handling Argument Injection

[Peaches]

Google Apps "googleapopos.url.mailto" URI Handling Argument Injection

Highly Critical

Description:

pyrokinesis has discovered a vulnerability in Google Apps, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an error in googleapps.exe when handling arguments received via a "googleapps.url.mailto:" URI. This can be exploited to pass arbitrary arguments to chrome.exe and e.g. execute arbitrary applications from a network share via a specially crafted "--renderer-path" option.

The vulnerability is confirmed in Google Apps version 1.1.110.6031 with Internet Explorer 7 and Google Chrome 2.0.172.43. Other versions may also be affected.

Secunia Advisories - http://secunia.com/advisories/36924/